Implementing the GENIUS Act: FinCEN and OFAC Propose AML and Sanctions Program Requirements

The U.S. Department of the Treasury’s (Treasury) Financial Crimes Enforcement Network (FinCEN) and the Office of Foreign Assets Control (OFAC) recently issued a joint proposed rulemaking (Proposal) that would implement the anti-money laundering and sanctions program requirements of the Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act).¹ If adopted as proposed, the new program requirements would apply to “permitted payment stablecoin issuers” (PPSIs) as defined by the GENIUS Act and would become effective 12 months after publication of the final rule. In addition to seeking general comments on the Proposal, FinCEN and OFAC posed nearly 60 specific questions on which they solicited feedback. Comments are due by June 9, 2026.

The Proposal, which follows an advance notice of proposed rulemaking in the fall of 2025,² would impose five general categories of obligations on PPSIs, as discussed below.

Written Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) Compliance Program

The AML/CFT program would include policies and procedures (including a mandatory risk assessment process), independent testing, ongoing training, and designation of an AML/CFT Officer. The Proposal largely mirrors the proposed revisions to existing BSA/AML program requirements for most financial institutions (including banks and broker dealers) recently issued by FinCEN, including the formalization of the risk-assessment requirement, the incorporation of the previous fifth “pillar” (Customer Due Diligence) into the “policies and procedures” pillar, and the redesignation of the program’s title from “BSA/AML” to “AML/CFT.” PPSIs would also be subject to the due-diligence and enhanced due-diligence requirements applicable to certain private banking and correspondent accounts under the USA PATRIOT Act, as well as any “Special Measures” that FinCEN imposes under Section 311 of that Act. The AML/CFT program would require board-level (or similar) approval.

Significantly, the Proposal would adopt FinCEN’s new approach to supervision and enforcement, whereby neither FinCEN nor the relevant prudential regulator would take a significant enforcement or major supervisory action against a PPSI for an AML/CFT program violation unless the failure constituted “a significant or systemic failure to maintain that program.”

Suspicious Activity Reporting

PPSIs would be required to file suspicious activity reports (SARs) to advise law enforcement of suspected violations of law. Notably, the requirement would apply only to transactions occurring on the PPSI’s primary market (i.e., transactions in which the PPSI is directly involved), not to transactions occurring on the secondary market for the PPSI’s stablecoin offering. A $5,000 threshold would apply.

Recordkeeping; Information Sharing

PPSIs would be subject to recordkeeping requirements similar to those of other financial institutions, including the Recordkeeping Rule and the Travel Rule (regarding certain funds transfers and the conveyance of payment details to other institutions, respectively). Certain cross-border transfers of assets, as well as certain extensions of credit, would also be covered. A five-year retention period would apply.

PPSIs would also be expressly covered by sections 314(a) and (b) of the USA PATRIOT Act. Section 314(a) requires institutions to provide certain information to FinCEN upon request. Section 314(b) permits institutions, on a voluntary basis, to share information among themselves to assist with identifying and reporting possible money laundering or terrorist activity.

Effective Sanctions Compliance Program

PPSIs would be required to adopt and maintain a sanctions compliance program with five key elements:

• Senior management and organizational commitment (including that the program be fully integrated in the PPSI’s payment stablecoin operations and apply to all payment stablecoin activity; allow for sufficient authority, autonomy, and resources; and routinely provide updates and testing reports to senior management and other appropriate personnel).
• Periodic holistic sanctions-related risk assessments, updated as circumstances warrant, to be used to inform and update the PPSI’s sanctions compliance program. 
• Risk-based internal controls to identify and take appropriate action in response to payment stablecoin transactions (on both primary and secondary markets) that would violate U.S. sanctions laws. 
• Independent testing/auditing with appropriate accountability, resources, expertise, and authority.
• Ongoing risk-based training tailored to the institution and its relevant personnel and stakeholders. Standard OFAC recordkeeping and reporting requirements would apply.

Ability To Block, Freeze, and Reject Certain Specified or Impermissible Transactions

PPSIs would be required to have “technical capabilities, policies, and procedures to block, freeze, and reject specific or impermissible transactions that violate Federal or State laws, rules, or regulations.” Such capability would need to include the ability to comply with any “lawful order.” As with the sanctions compliance program, and unlike the proposed SARs rule, this requirement covers both a PPSI’s primary and secondary markets.

Takeaways

Although the Proposal incorporates new material such as the formalized risk-assessment process and the mandatory sanctions compliance program, in many ways it adheres to existing regulations and supervisory expectations. However, FinCEN has had to tailor existing regulations significantly to adapt the Proposal to the unique circumstances of PPSIs and payment stablecoins, and industry participants should take particular note of the technical aspects of the Proposal and offer feedback where appropriate. Also, in addition to numerous questions about the Proposal’s specific provisions, FinCEN has asked for comments on how, for PPSIs that are subsidiaries of financial institutions, the proposed requirements will or will not integrate effectively into existing organizational AML/CFT programs, and has also asked whether any of the Proposal’s provisions should be extended to foreign payment stablecoin issuers.

If you have any questions regarding the Proposal or need assistance in determining whether to comment on the Proposal, please contact any of the authors of this Advisory or your usual firm contact.

© Arnold & Porter Kaye Scholer LLP 2026 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.